[tompark]

Most developers I know don't seem to care about the "right way" to run agents. They either yolo it on their primary dev machine, or setup a separate box (VM, VPS, Rpi, Mac mini) and let it run there with minimal protection. You could simply do the same, running Hermes or Pi on a VPS (e.g. Digital Ocean). Note that Pi has no protections so you probably ought to take extra steps. Hermes uses a container.

My setup took a long time to build and I don't know any devs personally who go thru the trouble.

* I use a custom harness in a podman container run by a non-sudoer system account. File access is limited to specific ZFS datasets. I don't use Anthropic models for agentic work.

* You can find an open-source network proxy that injects credentials into the network requests, I made a custom one.

   https://github.com/onecli/onecli
   https://github.com/smart-mcp-proxy/mcpproxy-go
   https://github.com/mcpharbour/mcpharbour
   https://github.com/bglusman/calciforge 

* I made a custom shell (nearly posix-compliant) and don't give it access to regular bash, thus no need to filter its shell commands. You could use an open-source one if you care about this: `https://github.com/search?q=agent+bash+shell&type=repositori...`

* Same story for agent memory, context management and token reduction/compression, but this requires a lot of constant tweaking. Again, there are a lot of open-source repos addressing these aspects. Just search github, hn.algolia.com, and/or look at subreddits like /r/agentsofai /r/ai_agents

* Also the agent must be able to run/test the generated code, so if you're targeting another platform you need a MCP or deployment tool that'll allow testing.